Aller au contenu
en Se connecter
3.7 Faible

CVE-2021-21970 An out-of-bounds write vulnerability exists in the HandleSeaCloudMessage functionality of Sealevel Systems, Inc

Description

An out-of-bounds write vulnerability exists in the HandleSeaCloudMessage functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. The HandleIncomingSeaCloudMessage function uses at [3] the json_object_get_string to populate the p_name global variable. The p_name is only 0x80 bytes long, and the total MQTT message could be up to 0x201 bytes. Because the function json_object_get_string will fill str based on the length of the json’s value and not the actual str size, this would result in a possible out-of-bounds write.

Produits et versions touchés

Produit Versions touchées Corrigé en
Sealevel Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Sealevel

Les 10 CVE de Sealevel →
CVE-2021-21962 A heap-based buffer overflow vulnerability exists in the OTA Update u-download functionality of Sealevel Systems, Inc 9.0 Critique CVE-2021-21968 A file write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc 8.1 Élevée CVE-2021-21959 A misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc 7.7 Élevée CVE-2021-21965 A denial of service vulnerability exists in the SeaMax remote configuration functionality of Sealevel Systems, Inc 8.6 Élevée
Suivre cette CVE